drop tails persistent volume mount · parse retained user data + dotfiles
live/persistence/TailsData_unlocked/persistent · .gnupg · .ssh/known_hosts · .mozilla/firefox · tor-browser · wallet paths
heuristic parsing only · encrypted PV passphrases not cracked · sqlite dbs inventoried not fully queried · no live network